<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div dir="ltr" text-align="left">
<div dir="ltr" text-align="left">
<div dir="ltr" text-align="left" data-ogsc="" style="">
<div dir="ltr" text-align="left">
<div dir="ltr" text-align="left" data-ogsc="" style="">
<div dir="ltr" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255); text-align: left;">
<meta content="text/html; charset=Windows-1252">
</div>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr" style="">
<div dir="ltr" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255); text-align: left;">
Hello,</div>
<div dir="ltr" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255); text-align: left;">
<br>
</div>
<div dir="ltr" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255); text-align: left;">
While it is probably a good thing to not use ECB I can imagine you actually need it to implement single-block operations, so I am not sure if it’s a good idea if any general purpose JVM does not provide AES/ECB or RSA/ECB? (Maybe a new raw single block mode
instead?)</div>
<div dir="ltr" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255); text-align: left;">
<br>
</div>
<div dir="ltr" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255); text-align: left;">
For example TLS1.2 handshakes would need RSA/ECB/NoPadding and AES Key Exchange in smime would need AES/ECB as the primitive.</div>
<div dir="ltr" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255); text-align: left;">
<br>
</div>
<div dir="ltr" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255); text-align: left;">
On the other hand, requiring 3DES might really not be a requirement anymore, while at it remove it, also?</div>
<div dir="ltr" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255); text-align: left;">
<br>
</div>
<div dir="ltr" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255); text-align: left;">
Gruss</div>
<div dir="ltr" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255); text-align: left;">
Bernd</div>
<div id="ms-outlook-mobile-signature">
<div style="direction:ltr">-- </div>
<div style="direction:ltr">http://bernd.eckenfels.net</div>
</div>
</div>
</div>
</div>
<div> </div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif"><b>Von:</b> security-dev <security-dev-bounces@openjdk.java.net> im Auftrag von Sean Mullan <sean.mullan@oracle.com><br>
<b>Gesendet:</b> Mittwoch, November 6, 2019 5:28 PM<br>
<b>An:</b> security Dev OpenJDK<br>
<b>Betreff:</b> RFR [14] 8214483: Remove algorithms that use MD5, DES, or ECB from security requirements
<div> </div>
</font></div>
Please remove this change to remove the Java SE requirements to <br>
implement security algorithms based on DES, MD5, or ECB. It makes sense <br>
to periodically review these requirements and remove algorithms or modes <br>
that are known to be weak and of which usage has declined significantly <br>
and thus compatibility risk is much lower. <br>
<br>
Note that we are not removing the actual implementations of these <br>
algorithms from the JDK. This just means that an SE implementation is <br>
not required to support these algorithms. <br>
<br>
webrev: https://cr.openjdk.java.net/~mullan/webrevs/8214483/webrev.00/ <br>
CSR: https://bugs.openjdk.java.net/browse/JDK-8233607 <br>
<br>
Thanks, <br>
Sean <br>
<br>
</div>
<!--{"start":[1,0,0,0,4,0,95],"end":[1,0,0,0,4,0,95]}--></div>
<!--{"start":[1],"end":[1]}--></div>
<!--{"start":[0,0,1,24,5],"end":[0,0,1,24,53]}--></div>
<!--{"start":[0],"end":[0]}--></div>
</div>
</body>
</html>